Gabriel Brown
13f3648e4d
Phase 3 of the fresh-install spec: the parts of a run that depend on what the machine actually is. NVIDIA, Secure Boot, Fedora's preinstalled extras, firmware. Two of these looked like they would force a compromise, and neither did. sunhat opened an editor in the middle of its run so grub could be hand-corrected, and that single step is why walking away from an install did not work. The step existed to delete duplicated kernel arguments -- and grubby replaces an argument that already exists rather than appending a second copy, so the duplicates cannot accumulate and there is nothing to correct. The editor was load-bearing for a problem that a different tool does not have. MOK enrolment needs a password now and the same password at the next boot's blue screen, which reads like a prompt that has to happen mid-run. mokutil has --generate-hash and --hash-file for exactly this: the interview asks, hashes it on the spot, and records only the hash. The plaintext never reaches the answers file, the environment, or a command line, and the stage runs without asking. The stage runs last rather than fourth as the spec's table had it. The constraint was always "late" and fourth of eight is not late: enrolment arms a prompt for the next boot and firmware may want a reboot, so a machine that reboots out of this stage should already be completely configured. Every question names what was found -- the card, the packages actually installed -- and is not asked at all on a machine it would do nothing to. sunhat's debloat list no longer describes Fedora 44: totem became showtime and LibreOffice is not preinstalled, so the list is curated and a package that is not installed is never passed to dnf, which is what lets it outlive a release. This stage cannot be verified by running it. It installs a proprietary driver and queues a Secure Boot enrolment, and this machine is an AMD desktop. So every privileged command is stood in on PATH and the contract asserts which answer led to which call: that no answers means no commands, that a failed driver install is not followed by arguments and services for a driver that is not there, that the hash reaches mokutil through a file and never a command line, and that removal is offered only for packages that are installed. The contract was checked by breaking the stage three ways and confirming it caught each. It does not verify that akmod-nvidia builds, and says so where a reader would otherwise assume it did. The README's stage table listed three of seven stages; the interview and identity work never reached it. Corrected rather than extended, since a table that lists three of seven is worse than one that lists none. The Desktops section still describes a GNOME session nothing installs -- that is phase 5. Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj
76 lines
1.9 KiB
Plaintext
76 lines
1.9 KiB
Plaintext
adw-gtk3-theme
|
|
akmods
|
|
alsa-plugins-pulseaudio
|
|
cascadiamono-nerd-fonts
|
|
decibels
|
|
# The Wayland build specifically; the x11 one cannot inject into this session.
|
|
# Its config is linked by link-dotfiles.
|
|
espanso-wayland
|
|
desktop-file-utils
|
|
dnf-plugins-core
|
|
ffmpeg
|
|
firamono-nerd-fonts
|
|
fuse-libs
|
|
# Ghostty and its config in config/dot/ghostty are linked by link-dotfiles.
|
|
ghostty
|
|
# The Calendar agenda opens events in this; see CalendarAgenda.qml.
|
|
gnome-calendar
|
|
# NOT GNOME-session residue. Panama's own Settings hands off to this for the
|
|
# panels it deliberately does not own -- Online Accounts, Region, Colour,
|
|
# Accessibility, Wellbeing, Wacom. See SystemSettings.qml's panel allow-list.
|
|
gnome-control-center
|
|
# install-hardware sets the nouveau blacklist and nvidia-drm.modeset with
|
|
# grubby, which replaces an argument it already set rather than appending a
|
|
# second copy -- the reason that stage needs no editor.
|
|
grubby
|
|
gstreamer1-plugin-fmp4
|
|
gstreamer1-plugin-gif
|
|
gstreamer1-plugin-gtk4
|
|
gstreamer1-plugin-hsv
|
|
gstreamer1-plugin-json
|
|
gstreamer1-plugin-libav
|
|
gstreamer1-plugin-mp4
|
|
gstreamer1-plugin-openh264
|
|
gstreamer1-plugins-bad-free-devel
|
|
gstreamer1-plugins-good
|
|
gstreamer1-plugins-good-extras
|
|
gstreamer1-plugins-good-gtk
|
|
gstreamer1-plugins-good-qt
|
|
gstreamer1-plugins-good-qt6
|
|
hipblas
|
|
jetbrainsmono-nerd-fonts
|
|
kernel-devel
|
|
lame
|
|
lame-devel
|
|
libva-devel
|
|
libva-utils
|
|
libxcrypt-compat
|
|
loupe
|
|
mesa-libGL-devel
|
|
mesa-libGLU
|
|
mesa-libOpenCL
|
|
mokutil
|
|
mozilla-openh264
|
|
# Arial, Georgia and Times, so web pages that assume them render correctly.
|
|
mscore-fonts
|
|
nautilus
|
|
nautilus-extensions
|
|
nautilus-python
|
|
nextcloud-client
|
|
openssl-devel
|
|
opus-devel
|
|
papers
|
|
python3-dnf-plugin-versionlock
|
|
rocm-opencl
|
|
# The Snapshots page is snapper end to end; see scripts/panama-snapshots.
|
|
snapper
|
|
sushi
|
|
# Fonts the desktop names by family and would otherwise render as tofu.
|
|
# VictorMono is required: it draws every glyph in the shell.
|
|
victormono-nerd-fonts
|
|
wine
|
|
wine-core
|
|
wine-mono
|
|
winetricks
|
|
xdg-utils
|